Searching for Smishing Triad DNS Traces

The Smishing Triad struck again, but this time, they’re trailing their sights on users in the U.S.¹

The threat group is proving that phishing can take on many forms. While most attackers typically target vulnerable users on their computers, Smishing Triad has extended their reach to devices we can’t live without—our mobile phones.

Twenty-seven indicators of compromise (IoCs) have been identified in connection to the latest attacks leveraging parcel delivery failure text messages supposedly from the U.S. Postal Service (USPS).

The WhoisXML API researchers expanded the published list of IoCs to find other potential attack entry points and uncovered:

• 19 IP addresses to which the domains resolved, two of which are already classified as malicious based on malware checks
• 124 domains containing strings found among the IoCs, 34 of which are already considered malicious based on a bulk malware check
• 2,395 domains containing usps registered between 1 August and 13 September 2023 alone, 595 of which are already detected as malicious based on a bulk malware check

Download a sample of the threat research materials now or contact us to access the complete set of research materials.

—

• [1] https://www.resecurity.com/blog/article/smishing-triad-targeted-usps-and-us-citizens-for-data-theft